The short version

This website shows no adverts, does not track you from site to site, and sets no cookies beyond the spam check on the contact form, which is why there is no cookie banner.
If you get in touch, I use what you send me to reply, and nothing else.
If you book an assessment, I collect information about the person being assessed that is sensitive, including information about their health and learning. I only collect it with your explicit consent, I keep it securely, and I do not share it without your permission, except to keep a child safe.
I never sell your information or pass it on for marketing.

Who I am

Helen’s Place is the practice of Dr Helen Ross. I am responsible for the personal information described here, which makes me its data controller under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

You can contact me about anything in this policy at helen@helensplace.co.uk.

When you visit this website

Analytics

I use Cloudflare Web Analytics to see which pages people find useful. I chose it deliberately, because it is the least intrusive option I could find.

It sets no cookies, stores nothing on your device, and does not use fingerprinting. It cannot follow you to other websites, and it does not build a profile of you or recognise you if you come back. What I see are aggregate counts: which pages were viewed, which site or search sent someone here, and a broad breakdown by country, browser and device type. I cannot identify an individual visitor from it.

The website also keeps its own simple count of which pages are read from which town. Cloudflare estimates the town from your connection, and only the page and the town name are recorded: no IP address, no postcode and nothing about your device. These counts are deleted after three months.

Your IP address is used momentarily to work out roughly where a visit came from (at most, the town) and to filter out automated traffic. It is not stored against your visit and it is not available to me. You can read exactly what Cloudflare collects in its Web Analytics documentation.

My lawful basis is legitimate interests: knowing which pages help people, so I can improve them.

Hosting

The site is hosted by Cloudflare. Like any web host, its servers briefly record technical details of each request, such as your IP address, browser and the page asked for, to deliver the page, keep the site secure and fix faults. I do not use these records to identify anyone.

Cookies and your reading settings

This website sets no cookies of its own. The one exception is the spam check on the contact form, Cloudflare Turnstile, which may store what it needs to tell people from robots. That is strictly necessary to keep the form working, so it does not need consent.

The reading comfort buttons at the top of each page (larger text, more spacing and the lilac tint) remember your choice by storing it in your own browser. It never leaves your device and I cannot see it. Because it only does what you ask it to, it does not need consent under the Privacy and Electronic Communications Regulations. Resetting the buttons, or clearing this site’s data in your browser, removes it.

Videos and links to other sites

The Elevator Series videos are hosted by Vimeo and play in Vimeo’s “do not track” mode, so Vimeo does not set tracking cookies when you watch them. Links to podcasts, YouTube, publishers and other sites take you to those sites, and their own privacy policies apply once you are there.

When you contact me

The contact form asks for your name, email address, what your enquiry is about and your message, and optionally your phone number and organisation. When you send it, Cloudflare runs a quick check, called Turnstile, that the message is from a person rather than a spam robot, and then Resend delivers your message to me by email. Turnstile only looks at what it needs to tell a person from a robot, uses it for nothing else, and Cloudflare cannot identify you from it. If you email or phone me instead, I receive the same kind of information directly.

I use it to reply to you and, if you decide to go ahead, to arrange the work. My lawful basis is taking the steps you have asked for before we agree any work, or legitimate interests where you are asking on behalf of a school or organisation.

Please do not put detailed information about a child’s needs or health in the form. A short description is plenty, and we can talk through the rest on the free call.

If an enquiry does not lead to any work, I delete it after 12 months.

If you book an assessment

What I collect

To carry out an assessment and write the report, I collect:

your contact details, and the name and date of birth of the person being assessed
background information: how they are getting on at school, college or work, any earlier assessments or reports, and developmental, medical and family history that is relevant to learning, such as hearing, vision or a family history of dyslexia
the results of the tests we do on the day, and my notes
the report itself

Some of this is special category data under the UK GDPR, because it concerns health. I treat it with particular care.

Why I can use it

My lawful basis is the contract between us to provide the assessment. For the health-related information, it is your explicit consent, which I ask for in writing before the assessment. For a child, a parent or carer gives that consent, and I explain what is happening to the young person in a way that suits their age. You can withdraw consent at any time, though I may then be unable to finish the assessment or the report.

Who sees it

The report is written for you. I only share it, or anything else about the assessment, with a school, college, employer or anyone else when you ask me to or agree that I should.

The one exception is safeguarding. If I am worried that a child or young person is at risk of harm, I will share what is necessary with the right people, as set out in my safeguarding policy, and the law allows me to do this without consent.

How long I keep it

I keep assessment records until the young person reaches 25, or for 7 years after an adult’s assessment, so that a report can be reissued or explained if you need it later, for example when applying for exam access arrangements or Disabled Students’ Allowance. After that I delete or securely destroy it.

Assessments at Moon Hall

If you book an assessment with me at Moon Hall Assessment Centre in Reigate, the booking is made with Moon Hall, which is responsible for the information it collects under its own privacy policy.

Payments and invoices

You can pay by bank transfer, card, cheque or cash. I keep invoices and payment records for as long as tax law requires, usually six years. I never see or keep full card details: card payments are handled by the card payment provider.

Schools, research and expert witness work

Schools and organisations. For training and consultancy, I hold the contact details of the people I work with to arrange and deliver the work, under our contract or legitimate interests.

Research. Anyone taking part in one of my research studies receives a separate information sheet and consent form for that study, which explains how their information is used. My research follows the ethical guidelines of the British Educational Research Association.

Expert witness work. Information I receive when instructed as an expert witness is handled under the terms of that instruction and the rules of the court or tribunal.

Who else handles information for me

I use a small number of trusted services, which only process information on my instructions:

Cloudflare, Inc. hosts this website, provides the analytics described above, and runs the spam check on the contact form.
Resend delivers contact form messages to my inbox.
Just Host Me hosts my email, so it stores the emails I send and receive.
Vimeo delivers the Elevator Series videos when you play one.

Some of these are United States companies, so information may be processed outside the UK. Where that happens it is protected by safeguards approved under UK law, such as the UK Extension to the EU-US Data Privacy Framework or standard contractual clauses.

Your rights

You have the right to:

ask for a copy of the information I hold about you
ask me to correct anything that is wrong
ask me to delete your information
ask me to restrict how I use it, or object to my using it
ask for information you gave me in a format you can take elsewhere
withdraw your consent, where I rely on it

Some of these rights have limits. For example, I may need to keep invoices for tax reasons. Email me at helen@helensplace.co.uk and I will respond within one month.

If you are unhappy with how I have handled your information, please tell me first so I can try to put it right. You also have the right to complain to the Information Commissioner’s Office, on 0303 123 1113.

Video submissions

I may collect video submissions for use in books and articles at various points. By submitting a video, you agree to the following:

Purpose. Your video will be used solely for the promotion of the publication mentioned in the promotional material that you are responding to, and may be combined with other submissions to create a longer piece responding to the prompt questions.
Use and editing. Individual videos will not be altered, so no content will be added or removed, though they may be compiled into a larger video alongside other submissions.
Privacy. You are not required to provide your full name in the video.
Data security and retention. Videos will be stored securely and retained only for as long as necessary, in line with UK data protection law.
Sharing and distribution. Videos may be shared on social media platforms but will not be sold or passed on to third parties.
Editorial discretion. I reserve the right not to use any submitted videos.
Consent. By submitting a video, you confirm that you have the right to share its content and consent to its use as outlined above.

If you wish to withdraw your consent, please contact me at helen@helensplace.co.uk. Withdrawal will not affect any use made before your written withdrawal is received.

Changes to this policy

I will update this page if anything changes, for example if I change one of the services listed above. This policy was last updated in October 2026.

Privacy policy